CVE-2013-0281
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management...
CVE-2013-0281 is a medium vulnerability (CVSS 4.3) in Clusterlabs Pacemaker, published November 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.61%, the 85th percentile. Fixed in pacemaker 1.1.10-1.
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
Exploit likelihood
What each source reports
NVD Score used
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
CVE-2013-0281- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
CVE-2013-0281- Updated
- 2026-11-02
EUVDEUVD-2013-0305 No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
EUVD-2013-0305- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9mhm-24f3-gp3v No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management...
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
GHSA-9mhm-24f3-gp3v- Updated
- 2026-11-02
OSV No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
CVE-2013-0281- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0281 No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
DEBIAN-CVE-2013-0281- Updated
- 2026-11-02
OSVMGASA-2014-0069 No score
Updated pacemaker package fixes one security issue
A denial of service flaw was found in the way Pacemaker performed authentication and processing of remote connections in certain circumstances. When Pacemaker was configured to allow remote Cluster Information Base (CIB) configuration or resource management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving other requests) (CVE-2013-0281).
- Record
MGASA-2014-0069- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-0281 No score
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
- Record
UBUNTU-CVE-2013-0281- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pacemakerDebian:12 |
before 1.1.10-1 | 1.1.10-1 |
pacemakerDebian:13 |
before 1.1.10-1 | 1.1.10-1 |
pacemakerDebian:14 |
before 1.1.10-1 | 1.1.10-1 |
pacemakerMageia:3 |
before 1.1.8-4.1.mga3 | 1.1.8-4.1.mga3 |
pacemakerRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-cliRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-cluster-libsRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-ctsRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-docRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-libsRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-libs-develRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
pacemaker-remoteRed Hat:enterprise_linux:6::server |
before 0:1.1.10-14.el6 | 0:1.1.10-14.el6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2013-1635.html
github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93
bugzilla.redhat.com/show_bug.cgi?id=891922
nvd.nist.gov/vuln/detail/CVE-2013-0281
security-tracker.debian.org/tracker/CVE-2013-0281
Show 16 moreShow less
advisories.mageia.org/MGASA-2014-0069.html
bugs.mageia.org/show_bug.cgi?id=11724
redhat.com/security/data/cve/CVE-2013-0281.html
access.redhat.com/errata/RHSA-2013:1635
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1635.json
cve.org/CVERecord?id=CVE-2013-0281
ubuntu.com/security/CVE-2013-0281
openwall.com/lists/oss-security/2013/02/14/6